{"id":"@lssm-tech/app.cli-contractspec","slug":"app.cli-contractspec","name":"@lssm-tech/app.cli-contractspec","version":"9.1.6","path":"packages/apps/cli-contractspec","manifestPath":"packages/apps/cli-contractspec/package.json","manifestBlobSha":"5afbd22b0aa3b637e8a6d9d6c86f6eae16a3a0cc","layer":"apps","physicalArea":null,"primaryArea":"tooling-and-agent-delivery","classification":{"privateDeclared":null,"catalogFamily":"contracts","catalogKind":"app","catalogStatus":"active","adoptionMode":"operator-only","stability":"stable"},"description":"CLI tool for creating, building, and validating contract specifications","descriptionOrigin":"package.json","catalog":{"family":"contracts","kind":"app","status":"active","adoptionMode":"operator-only","stability":"stable","platforms":["server"],"runtimes":["bun","node"],"entrypoints":[".","./run"],"documentation":[{"title":"App Cli Contractspec documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Fapp.cli-contractspec","kind":"readme"}],"examples":[],"replacements":[],"nonAdoptableRationale":"This app is published for execution by operators, not as a reusable library dependency.","visualTesting":{"status":"deferred","owner":"@contractspec-core","targetWave":"wave-3-react-packages","rationale":"Foundational Storybook adoption establishes shared catalogs and guardrails before this package migrates."}},"canonicalImports":[],"scripts":{"publish:pkg":"bun run verify:pack && bun publish --tolerate-republish --ignore-scripts --verbose","publish:pkg:canary":"bun publish:pkg --tag canary","build":"bun run prebuild && bun run build:types && bun run build:all","build:bun":"bun scripts/build-runtime-bundle.mjs bun","build:node":"bun scripts/build-runtime-bundle.mjs node","build:optional":"bun scripts/build-runtime-bundle.mjs optional","build:all":"bun run build:bun && bun run build:node && bun run build:optional && bun run build:contribution-types","build:types":"tsgo --noEmit","prebuild":"bun ../../../scripts/generate-contractsrc-schema.ts","typecheck":"tsgo --noEmit","dev":"bun build --external '@lssm-tech/bundle.workspace' --external '@lssm-tech/bundle.workspace/*' --external '@lssm-tech/lib.cli-runtime' --external '@lssm-tech/lib.cli-runtime/*' ./src/cli.ts --outfile ./dist/cli.js --target node --watch --external playwright --external playwright-core --external electron --external chromium-bidi --external 'chromium-bidi/*' --external '@electric-sql/pglite' --external '@apollo/client' --external '@apollo/client/*' --external '@graphql-tools/schema' --external 'graphql' --external 'drizzle-orm' --external 'drizzle-orm/*'","dev:bun":"bun build --external '@lssm-tech/bundle.workspace' --external '@lssm-tech/bundle.workspace/*' --external '@lssm-tech/lib.cli-runtime' --external '@lssm-tech/lib.cli-runtime/*' ./src/cli.ts --outfile ./dist/cli.bun.js --target bun --watch --external playwright --external playwright-core --external electron --external chromium-bidi --external 'chromium-bidi/*' --external '@electric-sql/pglite' --external '@apollo/client' --external '@apollo/client/*' --external '@graphql-tools/schema' --external 'graphql' --external 'drizzle-orm' --external 'drizzle-orm/*'","clean":"rimraf dist","lint":"bun run lint:fix","lint:fix":"node ../../../scripts/biome.cjs check --write --unsafe --only=nursery/useSortedClasses . && node ../../../scripts/biome.cjs check --write .","lint:check":"node ../../../scripts/biome.cjs check .","test":"bun ../../../scripts/run-cli-blackbox-tests.mjs && bun test","test:watch":"bun test --watch","verify:pack":"bun run build && node scripts/verify-pack.mjs","build:contribution-types":"tsgo --ignoreConfig --declaration --emitDeclarationOnly --noCheck --isolatedDeclarations --noResolve --target ES2022 --module ESNext --rootDir src/program/optional-contributions --outDir dist/types/optional-contributions src/program/optional-contributions/ai.ts src/program/optional-contributions/builder.ts src/program/optional-contributions/examples.ts"},"scriptStatus":"complete pinned manifest","dependencies":{},"devDependencies":{"@ai-sdk/anthropic":"4.0.57","@ai-sdk/mistral":"4.0.47","@ai-sdk/openai":"4.0.70","@inquirer/prompts":"^8.7.2","@lssm-tech/agentpack.contractspec":"^2.0.1","@lssm-tech/agentpacks":"^3.0.1","@lssm-tech/bundle.library":"^5.0.2","@lssm-tech/integration.harness-runtime":"^2.0.2","@lssm-tech/integration.storybook":"^3.0.0","@lssm-tech/integration.lssm-os-operation-client":"^2.0.1","@lssm-tech/integration.provider-codex":"^2.0.2","@lssm-tech/integration.provider-opencode-go":"^2.0.2","@lssm-tech/integration.runtime":"^7.1.1","@lssm-tech/integration.workspace-ai":"^3.1.2","@lssm-tech/lib.ai-agent":"^17.2.2","@lssm-tech/lib.ai-providers":"^6.2.2","@lssm-tech/lib.builder-runtime":"^3.0.2","@lssm-tech/lib.builder-spec":"^2.1.1","@lssm-tech/lib.contracts-integrations":"^9.0.1","@lssm-tech/lib.contracts-runtime-client-react":"^6.0.1","@lssm-tech/lib.contracts-runtime-server-mcp":"^5.0.1","@lssm-tech/lib.contracts-spec":"^17.3.2","@lssm-tech/lib.contracts-transformers":"^5.0.1","@lssm-tech/lib.design-catalog":"^3.0.1","@lssm-tech/lib.design-system":"^14.0.3","@lssm-tech/lib.execution-lanes":"^3.1.1","@lssm-tech/lib.harness":"^3.0.1","@lssm-tech/lib.logger":"^5.0.1","@lssm-tech/lib.plugins":"^5.0.1","@lssm-tech/lib.schema":"^6.0.2","@lssm-tech/lib.testing":"^5.0.2","@lssm-tech/lib.utils-typescript":"^5.0.1","@lssm-tech/module.ai-chat":"^7.0.2","@lssm-tech/module.examples":"^6.1.1","@lssm-tech/module.workspace":"^7.0.2","@lssm-tech/tool.typescript":"^5.0.1","@modelcontextprotocol/sdk":"^1.30.0","@types/node":"^25.9.3","@types/sarif":"^2.1.7","ai":"7.0.106","chalk":"^6.0.0","commander":"^15.0.0","elysia":"^1.4.29","glob":"^13.0.6","happy-dom":"^20.14.0","jsonc-parser":"^3.3.1","ollama-ai-provider-v2":"catalog:ai","ora":"^9.4.1","pg":"^8.23.0","rimraf":"^6.1.3","react":"19.2.3","react-dom":"19.2.3","typescript":"^7.0.2","zod":"^4.5.4","@lssm-tech/lib.provider-ranking":"^2.0.1","@lssm-tech/lib.provider-spec":"^2.0.1","@types/pg":"catalog:types","@types/react":"catalog:types","@types/react-dom":"catalog:types","@lssm-tech/lib.cli-runtime":"workspace:^","@lssm-tech/bundle.workspace":"workspace:^"},"peerDependencies":{},"optionalDependencies":{},"peerDependenciesMeta":{},"bundledDependencies":null,"dependencyStatus":"complete pinned manifest","exports":{".":{"bun":"./dist/bun/cli.js","node":"./dist/node/cli.js","default":"./dist/node/cli.js"},"./run":{"bun":"./dist/bun/cli.js","node":"./dist/node/cli.js","default":"./dist/node/cli.js"},"./optional-contributions/ai":{"types":"./dist/types/optional-contributions/ai.d.ts","bun":"./dist/node/optional-contributions/ai.js","node":"./dist/node/optional-contributions/ai.js","default":"./dist/node/optional-contributions/ai.js"},"./optional-contributions/builder":{"types":"./dist/types/optional-contributions/builder.d.ts","bun":"./dist/node/optional-contributions/builder.js","node":"./dist/node/optional-contributions/builder.js","default":"./dist/node/optional-contributions/builder.js"},"./optional-contributions/examples":{"types":"./dist/types/optional-contributions/examples.d.ts","bun":"./dist/node/optional-contributions/examples.js","node":"./dist/node/optional-contributions/examples.js","default":"./dist/node/optional-contributions/examples.js"}},"publishExports":null,"types":null,"files":["dist"],"api":{"scope":"manifest-declared export entrypoints and catalog-declared imports","entries":[{"subpath":".","importPath":"@lssm-tech/app.cli-contractspec","target":{"bun":"./dist/bun/cli.js","node":"./dist/node/cli.js","default":"./dist/node/cli.js"},"targets":[{"conditions":["bun"],"target":"./dist/bun/cli.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["node"],"target":"./dist/node/cli.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["default"],"target":"./dist/node/cli.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"}]},{"subpath":"./run","importPath":"@lssm-tech/app.cli-contractspec/run","target":{"bun":"./dist/bun/cli.js","node":"./dist/node/cli.js","default":"./dist/node/cli.js"},"targets":[{"conditions":["bun"],"target":"./dist/bun/cli.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["node"],"target":"./dist/node/cli.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["default"],"target":"./dist/node/cli.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"}]},{"subpath":"./optional-contributions/ai","importPath":"@lssm-tech/app.cli-contractspec/optional-contributions/ai","target":{"types":"./dist/types/optional-contributions/ai.d.ts","bun":"./dist/node/optional-contributions/ai.js","node":"./dist/node/optional-contributions/ai.js","default":"./dist/node/optional-contributions/ai.js"},"targets":[{"conditions":["types"],"target":"./dist/types/optional-contributions/ai.d.ts","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["bun"],"target":"./dist/node/optional-contributions/ai.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["node"],"target":"./dist/node/optional-contributions/ai.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["default"],"target":"./dist/node/optional-contributions/ai.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"}]},{"subpath":"./optional-contributions/builder","importPath":"@lssm-tech/app.cli-contractspec/optional-contributions/builder","target":{"types":"./dist/types/optional-contributions/builder.d.ts","bun":"./dist/node/optional-contributions/builder.js","node":"./dist/node/optional-contributions/builder.js","default":"./dist/node/optional-contributions/builder.js"},"targets":[{"conditions":["types"],"target":"./dist/types/optional-contributions/builder.d.ts","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["bun"],"target":"./dist/node/optional-contributions/builder.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["node"],"target":"./dist/node/optional-contributions/builder.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["default"],"target":"./dist/node/optional-contributions/builder.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"}]},{"subpath":"./optional-contributions/examples","importPath":"@lssm-tech/app.cli-contractspec/optional-contributions/examples","target":{"types":"./dist/types/optional-contributions/examples.d.ts","bun":"./dist/node/optional-contributions/examples.js","node":"./dist/node/optional-contributions/examples.js","default":"./dist/node/optional-contributions/examples.js"},"targets":[{"conditions":["types"],"target":"./dist/types/optional-contributions/examples.d.ts","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["bun"],"target":"./dist/node/optional-contributions/examples.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["node"],"target":"./dist/node/optional-contributions/examples.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"},{"conditions":["default"],"target":"./dist/node/optional-contributions/examples.js","sourcePath":null,"sourceUrl":null,"sourceStatus":"declared target; source not verified"}]}],"entryCount":5,"namedSymbolCoverage":"catalog declarations only; exhaustive TypeScript symbols not extracted","installationStatus":"not verified"},"docsLinks":[{"title":"App Cli Contractspec documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Fapp.cli-contractspec","kind":"readme","pinnedUrl":null,"sourceStatus":"declared link; destination not verified"}],"sourceUrls":{"package":"https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/cli-contractspec","manifest":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/cli-contractspec/package.json","readme":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/cli-contractspec/README.md","guide":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/app.cli-contractspec.txt"},"readme":{"status":"available","body":"# @lssm-tech/app.cli-contractspec\n\nWebsite: https://contractspec.io\n\n**Slim CLI host for authoring, materializing, and validating ContractSpec targets.**\n\nThe optional AI, Builder and examples contribution exports include generated\ndeclarations under `dist/types/optional-contributions`. `build:all` emits these\nfrom their explicitly typed sources with isolated declaration generation; the\nordinary `build` still runs the complete CLI typecheck before bundling. Published\ntype exports therefore resolve without shipping the source tree.\n\n## What It Does\n\n- **Core commands** (`src/commands/`) - Authoring, validation, workspace, release,\n  registry, OpenAPI, Connect, CI, doctor, and maintenance surfaces.\n- **Command packs** - Optional command families discovered from direct consumer\n  dependencies carrying `contractspec.commandPack` metadata.\n- **Prompts** (`src/commands/create/wizards/`) - Interactive UI using `@inquirer/prompts`.\n- **CLI setup** (`src/index.ts`, `src/cli.ts`) - Commander.js configuration.\n- **Types** (`src/types.ts`) - CLI-specific types.\n- **Services** (`@lssm-tech/bundle.workspace/services/`) - Core use-cases.\n- `create.ts` - Authored target creation logic.\n- `build.ts` - Runtime/package materialization from authored targets.\n- `openapi.ts` - OpenAPI export.\n\n## Delivery onboarding and orchestration\n\nInitialize incrementally without selecting a CI or cloud provider:\n\n```bash\ncontractspec init --preset delivery-local\ncontractspec init --preset delivery-hybrid\ncontractspec init --preset delivery-managed\n```\n\nThe public orchestration commands retain the specialist Connect, Builder, and\nHarness commands underneath them:\n\n```bash\ncontractspec delivery plan --input delivery-material.json\ncontractspec delivery profile --input project-profile-material.json --output project-profile.json --json\ncontractspec delivery autonomy --policies autonomy-policies.json --context authenticated-scope.json --json\ncontractspec delivery status\ncontractspec delivery verify --plan .contractspec/delivery/plan.json\ncontractspec delivery replay --digest sha256:...\ncontractspec quality plan --input quality-material.json\ncontractspec quality run --plan quality-plan.json --registry quality-registry.ts --config runner.json\ncontractspec quality verify --plan quality-plan.json --receipt quality-receipt.json\n```\n\nThe local ledger is content-addressed and tamper-evident for replay, but it is\nnot production authority. Managed promotion still requires durable Connect\nread-back and an exact promotion permit.\n\n## Running Locally\n\nFrom `packages/apps/cli-contractspec`:\n- `bun run dev`\n- `bun run build`\n- `bun run test`\n- `bun run typecheck`\n\n## Usage\n\n```bash\nbun run dev\n```\n\n## Optional command packs\n\nThe default install intentionally excludes specialist command families. Install\nonly the packs a workspace uses:\n\n```bash\nbun add @lssm-tech/integration.cli-contractspec-design\nbun add @lssm-tech/integration.cli-contractspec-ai\nbun add @lssm-tech/integration.cli-contractspec-builder\nbun add @lssm-tech/integration.cli-contractspec-examples\n```\n\nThe host discovers packs only from the consuming workspace's direct\ndependencies. Loading is deterministic by package name, duplicate command names\nand pack load failures stop startup before argument parsing, and `.contractsrc`\ncan explicitly include or exclude packages (exclusion wins):\n\n```jsonc\n{\n  \"commandPacks\": {\n    \"include\": [\"@lssm-tech/integration.cli-contractspec-design\"],\n    \"exclude\": []\n  }\n}\n```\n\nUse `createCoreProgram()` when an embedding needs the synchronous, pack-free\nprogram. `createProgram()` performs discovery and is asynchronous:\n\n```ts\nimport {\n  createCoreProgram,\n  createProgram,\n} from \"@lssm-tech/app.cli-contractspec\";\n\nconst coreProgram = createCoreProgram();\nconst program = await createProgram({ consumerRoot: process.cwd() });\n```\n\nCalling an optional command without its pack prints the corresponding install\nhint. See `docs/migrations/cli-command-packs-v7.md` for the major-version\nmigration.\n\n## Local Connect review authority\n\n### Durable host-hook authority\n\nContracts-spec host hooks deny by default unless the repository host injects a\ntrusted `HookAuthorityPort`. Environment-selected modules are never loaded as\nauthority. Production hosts construct the port with\n`createSingleNodeHookAuthorityPort` from\n`@lssm-tech/integration.lssm-os-state-sqlite`, a migrated driver, the real\nConnect signature verifier, and a live binding resolver. Hook payloads carry\nthe signed V1 request as `authorityRequest`; session start also carries a\ncaller-generated `sessionCapability` through the dedicated one-use input. Only\nits signed SHA-256 commitment and opaque session reference reach durable state,\nreceipts, and output. Local patch-verdict JSON is never treated as signature or\nlive-binding authority.\n\n### Host hook run modes\n\nWith `--host claudecode|codex|cursor` and no durable authority wired, a hook\nevaluates Connect policy first (deny and rewrite always block), then lets the\nagent host's `permission_mode` decide whether the operator is asked:\n\n| Host mode | Run mode | Governed actions |\n| --- | --- | --- |\n| `bypassPermissions`, `dontAsk` | `autonomous` | never asked; destructive commands and immutable paths are denied with a reason |\n| `auto`, `acceptEdits` | `assisted` | asked only for high-criticality actions (protected paths, governance roots, review commands, `git push`/`merge`) or review verdicts |\n| `default` | `supervised` | asked |\n| `plan` | `readonly` | denied |\n\nShell policy covers every command a line runs: `cd <dir> && git push --force`,\n`git -C <dir> push -f`, `git push origin +ref`, `bash -c \"...\"` and\n`pwsh -Command \"...\"` are denied like the plain force push, in every run mode.\nThe generated Claude Code hooks govern both the `Bash` and `PowerShell` tools.\n\nAn operator can grant a bounded mode for the current worktree, including\n`full` (never asks; only policy denies block):\n\n```bash\ncontractspec connect mode show\ncontractspec connect mode set autonomous --for 8h --scope packages/domains --reason \"overnight refactor\"\ncontractspec connect mode clear\n```\n\n`.contractsrc.json` `connect.runModes` sets `default` (hosts that report no\nmode), `hostModes`, `maxLevel`, and extra `highCriticalityPaths`;\n`connect.durableAuthorityRequired: true` caps every run mode at `supervised`.\nAgent tool calls cannot raise their own autonomy: edits to hook settings or the\ngrant file and executed `connect mode set|clear` are asked in supervised and\nassisted modes and denied in autonomous and full. Every decision taken without\nasking is appended to `.contractspec/connect/run-mode-decisions.ndjson`.\n\nDurable local review uses PostgreSQL and does not require a separate database or a control-plane API token.\nConfigure `CHANNEL_RUNTIME_DATABASE_URL`, `DATABASE_URL`, or reuse the managed CompanyOS `LSSM_STUDIO_DATABASE_URL`, then inspect readiness and decisions:\n\n```bash\ncontractspec connect doctor --json\ncontractspec connect review get <decision-id> --json\ncontractspec connect review status <decision-id> --json\ncontractspec connect review approve <decision-id> --stdin --json\ncontractspec connect review reject <decision-id> --stdin --json\n```\n\nAfter tracked migrations reach `006a`, migration owners must run the conflict-aware\n`connect review provision-authority` dry run and then apply with exact role, issuer actor,\nauthorization fingerprint, reviewer email/fingerprint, authority-ref, and proof-ref confirmations. The command stores public\nmetadata only, verifies the explicit role equals the authenticated `session_user`/`current_user`,\nand accepts no private key. This direct, fully confirmed command is the deliberately narrow\nout-of-band bootstrap for the first reviewer; applying it through shell composition is denied,\nand later authority changes remain subject to Connect review.\nMigration owners can then idempotently enroll a human reviewer from a pending decision with\n`connect review enroll`, then create the exact short-lived signing packet with\n`connect review challenge`. Enrollment accepts only an Ed25519 public key (`--public-key` or\n`--stdin`) plus provenance/audit metadata; scope and capability always come from the stored\ndecision, and private key material is rejected.\n\nApprove/reject stdin must be a fresh human-signed challenge packet. Capability claims, TTY\nconfirmation, packet actor fields, fixture keys, and agent-authored signatures do not establish\nauthority. See `docs/runbooks/connect-local-review.md` for role setup and verification.\n\n## Recommended OSS Onboarding\n\n```bash\ncontractspec init --preset connect\ncontractspec validate\n```\n\nExample-backed onboarding is provided by\n`@lssm-tech/integration.cli-contractspec-examples`.\n\n## Discover capabilities (\"can it help?\")\n\nAsk whether ContractSpec already provides a capability — or whether your repo\nalready has one — before building it yourself. Fully offline, no model required.\n\n```bash\ncontractspec can-help \"render a data table from a contract\"\ncontractspec ask \"capture an invoice from a customer\" --scope workspace\ncontractspec can-help \"replace FastAPI\" --runtime node --stability stable --json\n```\n\nReturns a `have-it` / `can-help` / `gap` verdict over a two-tier corpus (the\nshipped ContractSpec + ecosystem adoption catalog plus a local overlay of your\nown surfaces), with the canonical surface to adopt and a confidence score.\n`--scope` accepts `all` (default), `workspace`, `installed`, `contractspec`, or\n`ecosystem`; `local` remains a compatibility alias for `workspace`. Results\ninclude installed state, target version, install command, canonical imports,\ndocumentation, alternatives, score reasons, and catalog provenance.\n\nThe same query is exposed to agents as the offline MCP tool `contractspec.can_help`\n(served by `contractspec mcp`).\n\n### Enforce reuse (Connect ladder)\n\n```bash\n# Graduated verdict: permit(0) / rewrite(10) / require_review(20) / deny(30)\ncontractspec connect leverage --intent \"build a multi-agent AI chat surface\"\n\n# Opt-in hard-deny at high confidence; bypass with a recorded override\ncontractspec connect leverage --intent \"...\" --deny --override \"need a bespoke variant\" --actor you\n```\n\n`deny` is opt-in and high-confidence only; an `--override` justification is\npersisted to `.contractspec/connect/leverage-overrides.json` as audit evidence.\n\n### Leverage-gap report & catalog freshness (CI)\n\n```bash\ncontractspec can-help report                 # where this repo reinvented existing capabilities\ncontractspec can-help catalog sync --json    # refresh the complete V2 local mirror\ncontractspec can-help catalog status --json  # source/hash/freshness/degraded state\ncontractspec can-help catalog search \"Pydantic\" --json\ncontractspec can-help catalog get \"@lssm-tech/lib.schema\" --json\ncontractspec can-help catalog --snapshot capability-catalog.json\ncontractspec can-help catalog --check capability-catalog.json   # exit 1 if stale (CI gate)\n```\n\n`contractspec connect adoption sync --json` and `can-help catalog sync` select\nthe newest hash-valid registry, installed, local-mirror, or CLI-embedded V2\ncatalog. In a workspace that contains `@lssm-tech/lib.contractspec-catalog`,\nthat package's own `catalog.json` is an installed candidate ranked above the\nlocal mirror, reported with the `catalog.workspace-package` diagnostic.\nOffline fallback is explicit in the returned diagnostics; the written\n`.contractspec/adoption/catalog.json` always contains the complete selected\ndocument rather than only local release artifacts.\n\n## Repository lifecycle\n\n```bash\ncontractspec update --json            # read-only V2 compatibility plan\ncontractspec update --check --json    # CI: non-zero for updates, blockers, or stale artifacts\ncontractspec update --apply --wave framework.expo-57\ncontractspec update --apply --wave peer-normalization\ncontractspec update --wave compatible.patch-minor --json # deprecated read-only aggregate\ncontractspec update --apply --wave compatible.ai\ncontractspec update --apply --wave compatible.tooling\ncontractspec update --apply --wave breaking.better-auth  # explicit migration review\ncontractspec update --apply --wave major.frontend\ncontractspec doctor --format json     # read-only health and provenance\ncontractspec doctor --fix             # sequential safe waves, then fresh checks\ncontractspec spec update <file>        # canonical spec editing command\n```\n\nUpdate selects the highest version compatible with framework constraints,\nruntime engines, package peers, singleton requirements, configured pins, and\nthe currently adopted stable or prerelease channel. V2 JSON includes the\nselected channel, constraint provenance, registry provenance, risk, blocked\nreasons, and deterministic waves. `@lssm-tech/*` metadata comes from public\nnpmjs package records; local workspace versions prevent publisher-repository\ndowngrades.\n\nApplying requires one explicit wave. Compatible patch/minor updates are split\ninto deterministic `compatible.<ecosystem>` transactions; the legacy\n`compatible.patch-minor` selector remains read-only. Semver-zero minor jumps,\n`0.0.x` changes, and version transitions with catalog migration metadata are\nreported as high-risk `breaking.<ecosystem>` waves. Doctor only auto-applies\nframework, peer-normalization, and compatible waves.\n\nExpo apps use Expo SDK API compatibility data and fall back offline to the\ninstalled `expo/bundledNativeModules.json`. Shared React and React Native stay\nsingletons, while mobile TypeScript is isolated in `catalog:native`. Existing\nbroad peer ranges remain unchanged; incompatible peers are widened without\nnarrowing already published compatibility. File, Git, workspace, and\nunsupported alias ranges stay unchanged with diagnostics. Receipts and rollback snapshots live under\n`.contractspec/update/transactions/`. The legacy `upgrade` command forwards to\nthis lifecycle for compatibility and also requires `--wave` when applying.\nWhen installation or verification fails, rollback restores owned files and\nthen reconciles the install tree from the restored lockfile; a failed frozen\nreinstall is reported as a failed rollback rather than a successful one.\nSelected waves verify the packages whose manifests changed, plus migration and\nDoctor checks. Repository-wide typecheck, lint, and tests remain final release\ngates rather than being repeated twice for every ecosystem wave.\n\n## Core Authoring/Build Model\n\n- `create` authors both runtime specs and package-oriented targets such as `module-bundle`, `builder-spec`, and `provider-spec`.\n- `build` materializes one authored target into runtime artifacts or package scaffolds.\n- `generate` runs workspace-wide generation for docs and derived artifacts.\n- `validate` checks authored targets, package scaffolds, and optional runtime implementations.\n- `contractspec create visual-scenario` scaffolds a provider-neutral\n  `.visual-scenario.ts` contract with safe synthetic capture defaults.\n- `contractspec build --target storybook [visual-scenario-file]` generates the\n  configured Storybook catalog; add `--check` in CI to fail on generated drift.\n- Example-backed onboarding is an optional command-pack responsibility rather\n  than part of the default CLI closure.\n\n## LSSM OS durable operation status\n\nThe CLI and default MCP server reuse the canonical LSSM OS operation client.\nThey do not define their own status, receipt, or error mappings.\n\n```bash\nexport LSSM_OS_AUTHORIZATION='Bearer <opaque-token>'\nexport LSSM_OS_AGENT_HOST_ORIGIN='https://agent-host.example.com'\n\ncontractspec lssm-os operation status operation-123 \\\n  --origin \"$LSSM_OS_AGENT_HOST_ORIGIN\" \\\n  --tenant-id tenant --workspace-id workspace --environment-id production\n```\n\nThe command writes the canonical CLI projection as JSON and exits `5` while\nthe durable operation is nonterminal, `0` after success, and `1` for terminal\nfailure or a closed canonical error. The MCP tool\n`contractspec.lssm_os.operation_status` uses the configured origin and returns\nthe exact canonical MCP structured content. Authorization is read only from\n`LSSM_OS_AUTHORIZATION`; it is never accepted as a command argument, MCP input,\nor returned evidence.\n\nThe package qualification suite also dereferences one real Agent Host HTTP 202\nresponse through the SDK, this CLI exit-5 path, MCP structured content, and the\ncanonical React hook. All five surfaces must retain the same operation and\nprojection digests; this is credential-free simulated parity, not live product\nor provider qualification.\n\n\n## Model Context Protocol (MCP) servers\n\nThe CLI ships two local, offline-first MCP servers over stdio. They replace the\npreviously hosted `api.contractspec.io` MCP endpoints (docs/cli/internal/contracts),\nwhich have been **removed** — point your editor/agent at the local commands below.\n\n```bash\n# Knowledge + author tools (default). Offline, zero setup, no network.\ncontractspec mcp\n\n# Runtime projection of THIS repo's own contracts (opt-in, fail-closed).\ncontractspec mcp --runtime\n\n# Operate against a different working directory:\ncontractspec mcp --cwd /path/to/project\n```\n\n- **`contractspec mcp` (knowledge + author tools)** — fully offline. Exposes docs\n  search/get/resolve-route/contract-reference/facets, CLI usage/suggest, the internal\n  endpoint catalog, examples browsing, and author tools over the consumer's `cwd`:\n  `contracts.list/get/validate/build/update/delete` plus the new **`contracts.create`**\n  spec scaffold. The knowledge corpus is generated at build time from the docblock\n  manifest + docs registry + example metadata (plus a small curated getting-started/patterns\n  overlay) and bundled into the published package, so it works with **no network and no setup**.\n- **`contractspec mcp --runtime` (runtime projection)** — opt-in. Discovers and loads the\n  consumer's own `OperationSpecRegistry` and projects it as MCP tools. It is **fail-closed**:\n  - Projects **only handler-backed operations** (spec-only ops are never surfaced).\n  - **Read-only queries are allowed; every write/command is DENIED by default** (destructive\n    and `admin` operations included). Permit specific writes by name via `.contractsrc.json`.\n  - On no registry / zero bound ops / load failure it prints a clear error to stderr, exits\n    non-zero, and registers nothing.\n\n### Security notes\n\n- **Author server has no policy gate (scope to trusted workspaces).** `contractspec mcp`\n  (the default knowledge + author server) exposes write tools — `contracts.create`,\n  `contracts.update`, `contracts.delete`, and `contracts.build` — that create, modify,\n  delete, and generate spec files in the working directory. There is no per-tool policy\n  check on this server, so only run it against a workspace you trust the connected agent\n  to modify (and prefer `--cwd` to scope it explicitly).\n- **`--runtime` handlers run as `actor: 'anonymous'`.** Every operation projected by the\n  runtime server is executed with an anonymous actor context. Consumers MUST NOT treat\n  `anonymous` as an elevated or privileged identity inside their handlers; gate any\n  sensitive behavior on explicit policy, not on the absence of an actor.\n\n### `.contractsrc.json` `mcp.runtime` keys (runtime server)\n\n```jsonc\n{\n  \"mcp\": {\n    \"runtime\": {\n      // Path to a module exporting an OperationSpecRegistry (named `registry`/\n      // `operations`/`ops`, or default). Overrides convention-based discovery.\n      \"registry\": \"dist/registry.js\",\n      // Operation keys allowed to be projected as writable tools (opt-in).\n      \"allowWrites\": [\"project.create\"]\n    }\n  }\n}\n```\n\nWhen `mcp.runtime.registry` is omitted, the server resolves candidate registry modules from\nthe contractsrc `operations` layout (and common defaults like `operations/`, `src/operations/`).\n**v1 limitation:** the `mcp.runtime` block is read directly (not yet part of the typed\n`contractsrc.schema.json`), so editor schema autocomplete is not available for these keys.\n\n### Editor wiring (`mcp.json` / settings)\n\n```json\n\"contractspec\": { \"command\": \"npx\", \"args\": [\"-y\", \"@lssm-tech/app.cli-contractspec\", \"mcp\"], \"env\": {} },\n\"contractspec-runtime\": { \"command\": \"npx\", \"args\": [\"-y\", \"@lssm-tech/app.cli-contractspec\", \"mcp\", \"--runtime\"], \"env\": {} }\n```\n\n> Migration from the removed hosted MCP: replace the old `api.contractspec.io` MCP entries in\n> your `mcp.json` (or `.claude`/`.cursor`/`.zed` config) with the two stdio entries above. Zed\n> entries also need `\"type\": \"stdio\"`. All MCP logging goes to **stderr**; stdout is the JSON-RPC channel.\n\n## Help and command discovery\n\n`contractspec --help` is the canonical public command index. It groups root commands by category and includes implemented public command families such as `intelligence`, `connect`, `release`, and `changelog`. Subcommand help uses the same grouped renderer, so `contractspec intelligence --help` and `contractspec connect --help` preserve clean descriptions and category headings instead of falling back to an unstructured command list.\n\n\n## Release capsule guardrails\n\nPrefer guided release authoring over raw YAML edits:\n\n```bash\ncontractspec release prepare --baseline main\ncontractspec release edit <slug>\ncontractspec release fix <slug> --write\ncontractspec release check --strict --baseline main\n```\n\n`contractspec connect hook release-capsule after-file-edit --stdin` validates `.changeset/*.release.yaml` and paired `.changeset/*.md` edits without mutating files. When malformed YAML is recoverable, `contractspec release fix <slug> --write` rewrites the canonical `.release.yaml` and preserves unsupported fields in `.changeset/<slug>.release.quarantine.yaml`; scalar values of the string-list fields (`deprecations`, `affectedRuntimes`, `affectedFrameworks`, `knownGaps`) are quarantined there too. The default dry run previews the plan and exits non-zero while a repair would change capsule content or quarantine something; capsules that differ from the canonical layout only in YAML formatting are listed as `formatting-only` and do not fail the preview (`--write` normalizes them).\n\n`contractspec release check` also reports advisory `validation-entries` warnings, which never fail the check: validation commands that read as labels, outcomes, placeholders or prose, commands that cite `packages/` or `examples/` paths missing from the workspace, and evidence that quotes a run of a command not listed in `validation.commands`.\n\n## Generative Core Preview Commands\n\nGenerative Core commands are thin CLI wrappers over workspace/bundle services. They expose graph and regeneration evidence without bypassing Connect review gates:\n\n- `contractspec graph inspect --json` reads authored contracts and workspace evidence and reports schema-versioned counts, diagnostics, and artifact paths.\n- `contractspec graph export --json` writes only canonical graph artifacts under `generated/contractspec/graphs/**` after deterministic artifact metadata is available.\n- `contractspec drift check --json` classifies contract, code, generated artifact, docs, tests, and downstream-consumer drift for advisory CI before strict gates.\n- `contractspec generate plan --dry-run --json` produces planned writes and provenance hashes without mutating files.\n- `contractspec generate apply --json` and future repair apply flows require `contractspec connect verify` to allow or review the protected/generated write.\n\n\n## Shell Completion\n\nInstall the package so the `contractspec` executable is available on your `PATH`, then choose one of the supported shells:\n\n```bash\ncontractspec completion script bash\ncontractspec completion script zsh\ncontractspec completion script fish\n```\n\nFor managed installation, write the completion file and optionally patch the shell profile:\n\n```bash\ncontractspec completion install bash\ncontractspec completion install zsh --write-profile\ncontractspec completion install fish\n```\n\n`completion install` always writes the generated completion script to a managed user config path. By default it does not edit startup files in non-interactive sessions. Use `--write-profile` to append an idempotent `source` block automatically.\n\n## Initialization Presets\n\n`contractspec init` is now preset-driven. The shared setup layer owns the flow, and the CLI just forwards the preset and renders the resulting next steps.\n\n```bash\n# Generic ContractSpec workspace setup\ncontractspec init --preset core\n\n# Enable ContractSpec Connect defaults and local artifacts\ncontractspec init --preset connect\n\n# Prepare Builder for a managed runtime\ncontractspec init --preset builder-managed\n\n# Prepare Builder for a local runtime\ncontractspec init --preset builder-local\n\n# Prepare Builder for a hybrid runtime\ncontractspec init --preset builder-hybrid\n```\n\nIn non-interactive mode, setup remains config-first: it writes `.contractsrc.json`, editor wiring, and tailored follow-up commands, but it does not call live Builder bootstrap APIs for you.\n\n`contractspec builder` remains control-plane-backed for managed, local, and hybrid runtime flows. The CLI resolves the Builder API base URL from `CONTRACTSPEC_API_BASE_URL`, then `.contractsrc.json` `builder.api.baseUrl`, then `https://api.contractspec.io`, and reads auth from the configured control-plane token environment variable.\n\nBuilder execution aliases are additive shorthands over canonical execution-lane artifacts:\n\n```bash\ncontractspec builder ralphone \"Finish this change\" --json\ncontractspec builder ultrawork \"Parallelize this rollout\" --json\ncontractspec builder ulw \"Parallelize this rollout\" --json\ncontractspec builder background --dry-run --json\ncontractspec builder tools doctor --json\ncontractspec builder tools diagnostics --json\n```\n\n`ralphone` starts the `complete.persistent` lane, while `ultrawork` and `ulw` start the `team.coordinated` lane. Persisted lane artifacts keep those canonical lane keys; aliases are only command-entry metadata.\n\n\n### Builder specs-pack dry-runs and Connect-gated apply\n\nUse `contractspec builder pack` when product intent lives in an external zip or folder and must be inspected before any repository mutation. Import, analyze, and plan emit structured JSON; `implement` remains dry-run only, while `apply` requires an explicit Connect decision and returns a fail-closed task ledger until approved Connect, replay, verifier, and test evidence are present.\n\n```bash\ncontractspec builder pack import specs/autonomous-company-specs --json\ncontractspec builder pack analyze specs/autonomous-company-specs --json\ncontractspec builder pack plan specs/autonomous-company-specs --dry-run --json\ncontractspec builder pack implement specs/autonomous-company-specs --dry-run --json\ncontractspec builder pack apply specs/autonomous-company-specs --connect-decision connect:decision:1 --json\n```\n\nThe pack report keeps external product intent separate from repository implementation reality, preserves source refs for README/AGENTS/prompts/examples/fixtures, surfaces ambiguity/readiness blockers, and recommends whole-pack versus layer-by-layer follow-up planning. The apply ledger records Contract Steward tasks before handwritten work, reviewed write scopes, required artifact kinds, and verifier blockers. Use `$ralplan` for reviewable implementation planning, `$ralph` for one-owner completion, and `$team` only when the Builder plan marks layers or package scopes safe to parallelize.\n\n### Translation diagnostics\n\nUse `contractspec i18n check` to run the reusable ContractSpec static translation diagnostics from the CLI. The command scans `packages/**/src/i18n/catalogs` by default, compares `en/fr/es`, and reports missing catalogs, missing or extra keys, blank values, ICU syntax failures, and placeholder parity issues.\n\n```bash\ncontractspec i18n check\ncontractspec i18n check --format json\ncontractspec i18n check packages/platform/agents/ai-agent --base-locale en --locales en fr es\n```\n\nJSON output is the stable automation surface and contains `{ ok, summary, issues }`. Optional `.contractsrc.json` `i18n` settings provide workspace defaults; command flags override config values.\n\n### Builder tmux Sessions\n\nUse `contractspec builder tmux` for full interactive Builder terminal work: REPLs, debuggers, TUIs, long-running dev servers, and local agent sessions that need a durable terminal instead of a one-shot command.\n\n```bash\ncontractspec builder tmux doctor\ncontractspec builder tmux start --session builder-debug -- node --inspect\ncontractspec builder tmux attach --session builder-debug\ncontractspec builder tmux send --session builder-debug -- npm test\ncontractspec builder tmux capture --session builder-debug --lines 120\ncontractspec builder tmux stop --session builder-debug\n```\n\nSessions default to `contractspec-builder`, use argv-based tmux calls, fail on existing sessions unless `--reuse` is set, and support JSON output for automation.\n\n### Builder agent lanes and diagnostics\n\nBuilder agent-lane commands keep persisted lane identity canonical even when operators use shorthand aliases:\n\n| Operator surface | Persisted lane key | Metadata |\n| --- | --- | --- |\n| `contractspec builder ultrawork` / `contractspec builder ulw` | `team.coordinated` | `sourceAlias: \"ultrawork\"` or `sourceAlias: \"ulw\"` |\n| `contractspec builder ralphone` | `complete.persistent` | `sourceAlias: \"ralphone\"` |\n| `contractspec builder background` | `team.coordinated` | background-agent lease, scope, status, cancel, and attach evidence |\n| `contractspec builder tools doctor` / `contractspec builder tools diagnostics` | diagnostics surface only | tool capability, adapter readiness, and degraded-state evidence |\n\nAliases are compatibility metadata, not new lane keys. Downstream state, release notes, workbench summaries, and replay artifacts should continue to branch on the canonical lane key and may display `sourceAlias` for human traceability.\n\n## Architecture\n\n- **Commands** (`src/commands/`) - Thin wrappers that call bundle services.\n- **Prompts** (`src/commands/create/wizards/`) - Interactive UI using `@inquirer/prompts`.\n- **CLI setup** (`src/index.ts`, `src/cli.ts`) - Commander.js configuration.\n- **Types** (`src/types.ts`) - CLI-specific types.\n- **Services** (`@lssm-tech/bundle.workspace/services/`) - Core use-cases.\n- `create.ts` - Authored target creation logic.\n- `build.ts` - Runtime/package materialization from authored targets.\n- `openapi.ts` - OpenAPI export.\n- `registry.ts` - Registry client.\n- `examples.ts` - Examples management.\n\n## Public Entry Points\n\n- Export `./run` resolves through `bun`, `node`, `default`.\n\n## Local Commands\n\nManaged CompanyOS historical approval databases may materialize a migration-007 decision while the\ndatabase stores the exact legacy text value `\"1\"`; only that value or integer `1` is normalized at the\ndatabase read boundary. Enroll and activate the human reviewer, resolve the signed approval, and replay\nbefore applying `007_approval_canonicalization_v1_integer`. The migration command dry-runs by default;\napply requires the exact migration ID through `--confirm-migration`, uses only\n`CHANNEL_RUNTIME_DATABASE_URL`, and ledger-replays as `existing`.\n\nThe tracked `001`-`006a` chain preserves every historical ledger ID while adding the nonce table,\nissuer fields, and nonce RLS required by reviewer runtime queries. Authority provisioning is a\nseparate dry-run-first command so reusable migrations contain no operator-specific trust record.\n\nManaged CompanyOS Connect review uses `contractspec connect review materialize --request <workspace-relative-json>`\nbefore `connect review enroll`. Materialization accepts no caller scope or capability and only\ncreates pending review authority. It is dry-run-first; apply requires `--apply`, the exact\npacket/source-diff confirmations, and `CHANNEL_RUNTIME_DATABASE_URL` (never the generic\n`DATABASE_URL` fallback). See `docs/runbooks/connect-local-review.md`.\n\n- `bun run dev` — bun build ./src/cli.ts --outfile ./dist/cli.js --target node --watch\n- `bun run build` — bun run prebuild && bun run build:types && bun run build:all\n- `bun run test` — isolated CLI black-box checks, then `bun test`\n- `bun run lint` — bun run lint:fix\n- `bun run lint:check` — biome check .\n- `bun run lint:fix` — biome check --write --unsafe --only=nursery/useSortedClasses . && biome check --write .\n- `bun run typecheck` — tsgo --noEmit\n- `bun run publish:pkg` — bun publish --tolerate-republish --ignore-scripts --verbose\n- `bun run publish:pkg:canary` — bun publish:pkg --tag canary\n- `bun run clean` — rimraf dist\n- `bun run build:bun` — bun scripts/build-runtime-bundle.mjs bun (self-contained Bun bundle)\n- `bun run build:node` — bun scripts/build-runtime-bundle.mjs node (self-contained Node bundle)\n- `bun run build:all` — bun run build:bun && bun run build:node\n- `bun run build:types` — tsgo --noEmit\n- `bun run dev:bun` — bun build ./src/cli.ts --outfile ./dist/cli.bun.js --target bun --watch\n- `bun run test:watch` — bun test --watch\n\n## Recent Updates\n\n- Replace eslint+prettier by biomejs to optimize speed.\n- Add table capabilities.\n- Stability.\n- Vnext ai-native.\n- Add latest models and align defaults.\n- Resolve lint and build errors in workspace bundle and integrations lib.\n\n## Notes\n\n- Works alongside `@lssm-tech/bundle.workspace`, `@lssm-tech/lib.ai-agent`, `@lssm-tech/lib.ai-providers`, `@lssm-tech/lib.contracts-integrations`, `@lssm-tech/lib.contracts-spec`, ...\n- `contractspec apply` has been retired; use `contractspec generate` for write-generation flows.\n\n## Contract Intelligence\n\nThe CLI includes a dry-run-first `contractspec intelligence` workflow for analyzing the current repository, exporting a portable bundle, importing it into another target, reconciling reality, and producing a selective import plan. `analyze` defaults to repo-derived evidence; pass `--fixture <name>` only for deterministic examples and regression fixtures. `adopt --apply` is intentionally blocked until ContractSpec Connect review and replay evidence exist. See `docs/contract-intelligence.md`.\n\n`contractspec list --json`, `contractspec integrity --json`, and `contractspec integrity --format mermaid` are machine-output surfaces: stdout is reserved for the requested JSON or diagram, while human diagnostics belong in text mode or stderr. Discovery reports only authored contract/spec evidence and skips prompt/template implementation files that merely contain strings such as `key:`.\n\n`contractspec portfolio index|centralize|propagate|radar` creates advisory portfolio envelopes over bundle refs without mutating shared cores or vertical projects. See `docs/portfolio-centralization.md`.\n\n## i18n diagnostics\n\nRun static translation catalog diagnostics from a workspace or catalog directory:\n\n```bash\ncontractspec i18n check [path] --locales en fr es --format json\n```\n\nThe command reports reusable ContractSpec diagnostics for missing catalogs/keys, extra keys, blank values, malformed message shapes, invalid ICU syntax, and placeholder parity. JSON output is stable for CI and exits `1` for diagnostic failures or `2` for fatal config/import errors.\n\n## Restricted agent Markdown archives\n\nThese subcommands belong to the optional AI command contribution that provides\n`agent`; they are not registered by the base CLI alone. Configure that command pack\nbefore use.\n\n`contractspec agent migration archive --input selected.json --output archive.json`\nvalidates explicitly selected Markdown content and writes a new owner-readable\narchive. The input contains `id`, agent `scope`, `sourceRuntime` (`hermes` or\n`openclaw`), `sourceVersion`, `sourceRootRef`, `createdAt`, and `files` entries with\n`path` and `content`. No home-directory scan or instruction execution occurs.\n\n`contractspec agent migration inspect --input archive.json` verifies hashes and\nprints only counts and archive identity. Archive files contain private data; retain\nthem in restricted storage. These commands do not submit proposals, promote memory,\ninstall skills, reconnect credentials, or activate schedules/channels.\n\nThe package-local Turbo configuration lists the CLI's public workspace build and\ntypecheck dependencies explicitly. Its private Agent Host development dependency\nis used only by the source-level durable-operation parity test; compiling the\nhost's deployable server is not a prerequisite for the CLI. The parity test and\ndevelopment dependency remain in place. When changing CLI workspace dependencies,\nupdate both task lists and run `bun test scripts/delivery/cli-build-dependencies.test.mjs`\nfrom the repository root; this check also rejects unexpected private dependencies.\n\n## Published CLI artifact verification\n\n`bun run verify:pack` builds the actual CLI and verifies its canonical local\npublication projection without publishing. It requires every conditional root,\nbin, optional contribution and declaration target, plus exactly the emitted\nJavaScript dependency closure. Unreferenced chunks, source/test/map/cache files\nand unsafe archive members are rejected. Executable CLI targets retain the Node\nshebang; declaration files and imported contributions do not require a shebang.\nThe installed Node/Bun consumer keeps runtime authority and network policy gates.\n","sourcePath":"packages/apps/cli-contractspec/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/cli-contractspec/README.md","blobSha":"923e6eaa0fdadb9540d12d89a6bb312f9209ca00","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"tooling-and-agent-delivery","areaTitle":"CLI, authoring and agent tooling","displayName":"app.cli-contractspec","runtimes":["bun","node"],"platforms":["server"],"kind":"app","scope":"Package manifest","canonicalRoute":"/docs/packages/app.cli-contractspec/","contextUrl":"/docs/packages/app.cli-contractspec.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}